How to delete packets in wireshark GUI?

asked 2025-08-11 10:48:58 +0000

Mo
3 ●1 ●1 ●2

I have a capture where I manually want to remove a few packets. I'm able to filter and select them using standard filter tools, however, I'm unable to remove them.

I know there's editcap, which I'd use for heavier editing. I don't want to switch to console just to remove a packet.

This works OK, but is a little cumbersome:

Select all packets I wish to keep (e.g. via filter or CTRL + click)
File - Export Specified Packets
In the dialog, I select Selected packets only instead of "All packets".
Export to a temporary file, then overwrite original

edit retag flag offensive close merge delete

Comments

There's a good chance the list is out of date, but try here:
Wiki: Capture file editors and/or anonymizers

Chuckc ( 2025-08-11 11:21:24 +0000 )edit

5322: interactively delete packets from the capture

Chuckc ( 2025-08-11 18:19:03 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2025-08-11 14:51:10 +0000

johnthacker
276 ●51 ●6

updated 2025-08-11 14:52:03 +0000

To do this temporarily, you can ignore packets, which treats things as though those packets aren't there at all. Then when you go to Export Specified packets, ignored packets are not exported by default (there's a checkbox.)

https://www.wireshark.org/docs/wsug_h...